New sidecar filebeat failing

I recently upgrade from v2.5 to v3.1. Everything appears to be working properly now. I installed the new sidecar (v1.0.2) on a new server and when I try to config filebeat with the default settings (just change the server FQDN and log path) it says “Collector configuration file is not valid”
Screenshot_14

Here is my filebeat configuration file:
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
   hosts: ["FQDN-SERVER:5044"]
path:
  data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
 - windows
filebeat.inputs:
  type: log
  enabled: true
  paths:
- C:\Temp\test\*.log

The filebeat log on the sidecar server is:

2019-10-22T17:29:16.511-0400	INFO	instance/beat.go:544	Home path: [C:\Program Files\Graylog\sidecar] Config path: [C:\Program Files\Graylog\sidecar] Data path: [C:\Program Files\Graylog\sidecar\cache\filebeat\data] Logs path: [C:\Program Files\Graylog\sidecar\logs]
2019-10-22T17:29:16.516-0400	INFO	instance/beat.go:551	Beat UUID: 71d81ee2-8682-44a4-b67e-f30bd88d69e3
2019-10-22T17:29:16.517-0400	INFO	[beat]	instance/beat.go:768	Beat info	{"system_info": {"beat": {"path": {"config": "C:\\Program Files\\Graylog\\sidecar", "data": "C:\\Program Files\\Graylog\\sidecar\\cache\\filebeat\\data", "home": "C:\\Program Files\\Graylog\\sidecar", "logs": "C:\\Program Files\\Graylog\\sidecar\\logs"}, "type": "filebeat", "uuid": "71d81ee2-8682-44a4-b67e-f30bd88d69e3"}}}
2019-10-22T17:29:16.517-0400	INFO	[beat]	instance/beat.go:777	Build info	{"system_info": {"build": {"commit": "e193f6d68b25b7ddbe3a3ed8d60bc07fea1ef800", "libbeat": "6.4.2", "time": "2018-09-26T12:41:59.000Z", "version": "6.4.2"}}}
2019-10-22T17:29:16.517-0400	INFO	[beat]	instance/beat.go:780	Go runtime info	{"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.10.3"}}}
2019-10-22T17:29:16.537-0400	INFO	[beat]	instance/beat.go:784	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-10-20T08:46:35.29-04:00","hostname":"KRONOS","ips":["fe80::7058:6c02:479c:d637/64","192.168.0.12/24","fe80::3870:99a4:8c05:72d8/64","10.0.3.6/8","fe80::3561:a834:926d:8685/64","10.0.1.12/16","10.0.1.16/16","10.0.1.21/16","10.0.1.39/16","10.0.1.43/16","10.0.1.56/16","10.0.1.57/16","10.0.1.59/16","10.0.1.62/16","10.0.1.63/16","10.0.1.70/16","10.0.1.73/16","10.0.1.15/16","::1/128","127.0.0.1/8","fe80::5efe:a00:10c/128","fe80::5efe:a00:110/128","fe80::5efe:a00:115/128","fe80::5efe:a00:127/128","fe80::5efe:a00:12b/128","fe80::5efe:a00:138/128","fe80::5efe:a00:139/128","fe80::5efe:a00:13b/128","fe80::5efe:a00:13e/128","fe80::5efe:a00:13f/128","fe80::5efe:a00:146/128","fe80::5efe:a00:149/128","fe80::5efe:a00:306/128","fe80::5efe:c0a8:c/128"],"kernel_version":"6.3.9600.19478 (winblue_ltsb.190831-0600)","mac_addresses":["00:0c:29:63:e4:07","00:0c:29:63:e4:fd","00:0c:29:63:e4:f3","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2012 R2 Standard","version":"6.3","major":3,"minor":0,"patch":0,"build":"9600.19505"},"timezone":"EDT","timezone_offset_sec":-14400,"id":"30d9e0b3-fce9-4d5e-b1cd-5ffadc84ca02"}}}
2019-10-22T17:29:16.538-0400	INFO	instance/beat.go:273	Setup Beat: filebeat; Version: 6.4.2
2019-10-22T17:29:16.538-0400	INFO	pipeline/module.go:98	Beat name: KRONOS
2019-10-22T17:29:16.539-0400	ERROR	fileset/modules.go:118	Not loading modules. Module directory not found: C:\Program Files\Graylog\sidecar\module
2019-10-22T17:29:16.539-0400	ERROR	instance/beat.go:743	Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?

I tried running the filebeat from the command line and get the same result. Not sure what I’m missing at this point.

Thanks,
Perry

In case anyone else is having a similar issue, there appears to be a bug in the template for filebeat on Windows, there is a missing dash (-) before the word log, which causes the config file to be invalid.

output.logstash:
   hosts: ["FQDN-SERVER:5044"]
path:
  data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
 - windows
filebeat.inputs:
-  type: log  (- was missing in the template)
  enabled: true
  paths:
    - C:\Temp\test\*.log
1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.